Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
124 detections
Filters
Last updated
All Time
Detection languages
47
39
13
8
6
Contributors
24
24
18
14
10
Categories
66
52
31
22
20
Platforms
113
7
4
2
2
Products / Services
43
36
25
6
5
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
1
1
IDS Protocols
2
The following analytic detects a process enabling the "SeDebugPrivilege" privilege token. It leverages Windows Security Event Logs with EventCode 4703, filtering out common legitimate processes. This activity is significant because SeDebugPrivilege allows a process to inspect and modify the memory of other processes, potentially leading to credential dumping or code injection. If confirmed malicious, an attacker could gain extensive control over system processes, enabling them to escalate privileges, persist in the environment, or access sensitive information.
This rule detects processes invoking sensitive Windows API functions related to token manipulation (such as DuplicateToken, ImpersonateLoggedOnUser, or CreateProcessAsUser) when initiated by suspicious parent processes like PowerShell, CMD, or WScript. It uses a scoring system that increases risk if the execution occurs from common non-standard directories (e.g., Temp, Public) or is associated with non-system account contexts.
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
Detects the 'mscopilot.exe' binary performing token manipulation operations (DuplicateTokenEx, ImpersonateLoggedOnUser, SetThreadToken) followed by the creation of a new process with a different security context (CreateProcessAsUserW) within a five-minute window, indicative of C2 agent functionality.
Detects the execution of binaries using the '-i -c <batch_file>' command-line argument pattern, which is characteristic of the NetworkServiceExploit tool used for token impersonation and privilege escalation. This rule specifically monitors for this pattern when spawned by processes like sqlservr.exe, commonly seen in exploitation chains involving xp_cmdshell.
Detects the initiation of a new process where the effective user context is SYSTEM, but the originating process was launched by a non-privileged user account. This behavior is indicative of token manipulation techniques such as token impersonation or theft (e.g., via DuplicateTokenEx or ImpersonateLoggedOnUser) to escalate privileges to SYSTEM.
Detects the initiation of a new process where the effective user context is SYSTEM, but the originating process was launched by a non-privileged user account. This behavior is indicative of token manipulation techniques such as token impersonation or theft (e.g., via DuplicateTokenEx or ImpersonateLoggedOnUser) to escalate privileges to SYSTEM.
Detects non-SYSTEM processes enabling SeDebugPrivilege or SeImpersonatePrivilege shortly before launching a process as the SYSTEM user. This behavior is highly indicative of token manipulation and impersonation techniques (e.g., Potato-family exploits) used to elevate privileges from a standard or administrative account to SYSTEM.
Detects a specific pattern of Windows API calls consistent with PIVOTPIPE C2 activity, involving process token impersonation (OpenProcessToken, DuplicateTokenEx, ImpersonateLoggedOnUser, or SetThreadToken) followed by a RevertToSelf call. The rule correlates these events within a single process, identifies artifacts related to PIVOTPIPE loader/payloads, and ensures the sequence completes within a short time window.
Detects the assignment of SeDebugPrivilege or SeImpersonatePrivilege to a non-SYSTEM account, followed by the execution of a new process from common service parents (spoolsv.exe, w3wp.exe, dllhost.exe) within the same logon session. This behavior is indicative of privilege escalation attempts using local potato-style exploits (e.g., PrintSpoofer, JuicyPotato) that leverage service tokens for impersonation.
The following analytic detects duplicate-handle and query-limited-information access to winlogon.exe from an uncommon or public source path.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
Detects a specific execution pattern associated with the PIVOTPIPE RAT involving two consecutive operator-issued commands. First, a process impersonation action (token theft/impersonation) is detected via PROCESS_OPEN activity, followed by a 'RevertToSelf' call within the same process context. This sequence indicates an attempt to temporarily shift privilege context to impersonate another user before returning to the original security context.
The following analytic detects a process requesting duplicate-handle and query-limited-information access to winlogon.exe.
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
It leverages Sysmon EventCode 10 and checks for access masks that combine PROCESS_DUP_HANDLE (0x40) and PROCESS_QUERY_LIMITED_INFORMATION (0x1000).
This rule detects known side-loaded PlugX RAT host processes ('GRrte.exe' or 'Jarte.exe') located in 'JartePortable' directories attempting to modify process tokens or privileges. This behavior is indicative of privilege escalation preparation, a common activity for the PlugX modular RAT.
This rule detects potential Windows token manipulation by correlating logon events containing sensitive privileges (SeDebugPrivilege/SeImpersonatePrivilege) with subsequent process creation events under a different user context within a short timeframe. It further validates the activity by incorporating Sysmon Event ID 10 alerts that identify process access patterns commonly associated with token duplication or impersonation techniques used in post-exploitation frameworks like Cobalt Strike.
Detects the use of Windows API functions associated with token impersonation, such as ImpersonateLoggedOnUser and DuplicateTokenEx, or the RevertToSelf function, which can be indicators of token theft or privilege escalation attempts by an adversary.
Detects instances where a process is created with a session ID that differs from its parent process, which is indicative of token manipulation or impersonation techniques like those observed in SparroWocky. The rule looks for cross-session process creation using the CreateProcessAsUserW API or specific command-line argument patterns.
Detects token duplication/impersonation targeting winlogon.exe to obtain SYSTEM privileges (SeDebugPrivilege abuse, DuplicateToken, SetTokenInformation to Untrusted integrity)
Detects token duplication/impersonation targeting winlogon.exe to obtain SYSTEM privileges (SeDebugPrivilege abuse, DuplicateToken, SetTokenInformation to Untrusted integrity)
This rule detects attempts to manipulate process access tokens using the Windows 'SetTokenInformation' API. Specifically, it monitors for adjustments to token privileges or integrity levels, or the presence of 'Untrusted' markers. These behaviors are often indicative of an adversary attempting to bypass Windows access controls, perform token manipulation, or conduct privilege escalation.
The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
Page 1 of 6